Hey folks, I am trying to perform some restrictions on Azure Image Versions but I can't figure out a good way to do it. As my images are in an image gallery,

azure.image

does not work for me. I want to delete all images older than 10 days. I can use

azure.armresource

to get all the Image Definitions and I can use it to get all Image Versions. I correctly see them. However,

azure.armresource

doesn't scrape the

properties

of the objects, just the plain

id,name,etc

so I can't really combine / cross-reference the two. Policy in question:

policies:
- name: get-image-definitions
  resource: azure.armresource
  filters:
    - type: resource-type
      values:
        - Microsoft.Compute/galleries/images
    - type: value
      key: id
      op: contains
      value: "/galleries/mygallery/"

- name: get-image-versions
  resource: azure.armresource
  filters:
    - type: resource-type
      values:
        - Microsoft.Compute/galleries/images/versions
    - type: value
      key: id
      op: contains
      value: "/galleries/mygallery/"

Is there any way to get all Versions of a particular Definition? Or to force the

azure.armresource

to pull the

properties

of the object as well ? The

properties

key contains a key called

publishedDate

that I can use to wipe the images without caring which Definition they are a part of.

I don't know offhand. My default take is that for core info we can fetch in bulk, building it into the resource makes sense. For info that's required for the policy less often or needs an extra api call per resource, it's better as a dedicated filter

My thinking is that the

azurerm

resource is a bit of a powerhouse, as you can use it for a variety of calls for different resources. But without pulling the

properties

, you can only manage those resources by

tags

or

names

, which IMO isn't all that useful for most of the resources* Although it does make sense to just have a separate resource or filter than just

azurerm

for everything 🙂 • YMMV depending on how you leverage tags.